Introduction

When other people create tokens for you they might ask you for your public OpenPGP key.
This will allow them to encrypt the plaintext token so that it can be transmitted to you more securely. You'll then receive a PGP message like the below which you can decrypt using your private key.

OpenPGP Prerequisites

Download And Installation

There is a cross-platform frontend for OpenPGP which is recommended on the OpenPGP website.
It's called GPG Frontend and you can download it here:  https://www.gpgfrontend.pub/#/.
It only runs on 64Bit operating systems and also requires GnuPGP to be installed on the system, otherwise, there will be an error message when you start GPG Frontend.
We found that on macOS the error message only went away when using the GnuPG for OS X Installer for GnuPG provided via https://gnupg.org/download/index.html.

Installing GnuPGP is different for each operating system, you can find more help for other OS and also the installation of the frontend itself here: https://www.gpgfrontend.pub/#/quick-start?id=install-amp-run.

Creating A Public Key Using GpgFrontend

macOS

Start the app and open the Keys/ Manage Keys settings:

Click on Generate and New Keypair

Provide a Name and Email Address, click OK and protect the key pair with a password when prompted.
Make sure the Key usage supports Encryption.

You'll then see the new key pair in your Key Toolbox

To provide the public key to the person that creates the token for you, you can either go back to Manage Keys and export it to the clipboard

or you right-click on the pair in the Key ToolBox to show the key details

and export it to a file from there

Windows

The Windows version is nearly identical to the MacOS one. Please refer to the above instructions.

Decrypting the PGP Message Using GpgFrontend

Once you got back the encrypted token as a PGP message you can decrypt it with the same tool.

After entering the passphrase for your key pair/ private key the PGP message gets replaced with the token:

Creating A Public Key Using Commandline

The procedure is the same across all platforms and requires GnuGPG to be installed, as mentioned earlier.
On macOS and Linux you can use the gpg command from your terminal, on Windows from the command shell (cmd).

Create Key Pair

Create the pair with the below command and select the key type. The default selection should be the best choice in most cases.
The below example is from macOS with GnuPG 2.3.4 installed. I chose (9)

Select the elliptic curve, the default is the best choice again.

Specify how long the key should be valid, i.e. 1y for one year and confirm

Provide a real name, passwords and optional comment and confirm.

You'll be prompted to enter and confirm a passphrase for the private key portion afterwards.
This is the output after completing these steps:

Export The Public Key

The person who encrypts the token for you requires the public key. Here is how to export that key using the command line.

Exporting The Only Public Key 

If you only created one key pair, you can export the public key like this:

Exporting One From Many Public Keys

If you have other key pairs already and created a new one as described above, you can export that key by adding the public key identifier at the end:

If you don't know which public key is which, run the following to get a list. The identifier is displayed in the second line of the pub key

Decrypting the PGP Message Using the Commandline

There are various ways, but not all of them will work on every type of command line.

What should always work is to paste the encrypted token/ PGP message to a text file first and decrypt the file.
You'll get prompted for the private key passphrase and eventually see the token on that last line:

Other methods require the PGP message to be copied to the clipboard first. Please read the additional comment for each method below:

On Windows, the easiest way to do this is using Power Shell because it has built-in functionality to read from the clipboard.

If you can't use Power Shell, paste the PGP message to a text file first and decrypt it afterwards